Security Incidents mailing list archives

Re: Permissions

From: jlewis () LEWIS ORG (Jon Lewis)
Date: Tue, 27 Jun 2000 20:01:09 -0400


On Tue, 27 Jun 2000, Derick Schuetz wrote:

Are there any attacks that any of you have heard of that would change all
the permissions on the drive to 755 RECURSIVELY?  Running RH Linux 6.2


Any attack capable of spawning a shell could just as easily run a command
like chmod -R 755 /.  It'd be kind of silly though.  It seems more likely
an admin typo'd a chmod command.

----------------------------------------------------------------------
 Jon Lewis *jlewis () lewis org*|  I route
 System Administrator        |  therefore you are
 Atlantic Net                |
_________ http://www.lewis.org/~jlewis/pgp for PGP public key_________

Current thread:

Re: blind forwards, (continued)
- - - Re: blind forwards Ex Machina (Jun 29)
    - Re: blind forwards Brock Norvell (Jun 29)
    - Re: blind forwards John Hall (Jun 29)
    - Re: blind forwards David Pick (Jun 30)
    - Re: funky syslog entry UnixGeek (Jun 29)
    - Re: funky syslog entry Chris West (Jun 29)
    - wuftp exploit Toby Miller (Jun 28)
    - Re: wuftp exploit Daniel Jacobowitz (Jun 28)
    - Permissions Derick Schuetz (Jun 27)
    - Re: Permissions Valdis Kletnieks (Jun 27)
    - Re: Permissions Jon Lewis (Jun 27)
    - Probes for MySQL under Linux? Ralf G. R. Bergs (Jun 27)
    - Re: Probes for MySQL under Linux? Tabor J. Wells (Jun 27)
    - Port scan (106 and 389) Chris Laycock (Jun 28)
    - Compromise and Bind Replacement Scott Brown (Jun 28)
    - Re: Port scan (106 and 389) Fabio Pietrosanti (Jun 28)
    - Re: Probes for MySQL under Linux? Al Huger - Mail Account (Jun 28)
    - Was I exploited? Narins, Joshua (Jun 29)
    - Re: Was I exploited? Russ Spooner (Jun 29)
    - Re: Nike Site taken over Ballard, James (Jun 27)
    - port 1433? Sir Scriptzalot (Jun 25)

(Thread continues...)